Apache Camel’s CXF and Knative header filters fail to block inbound Camel‑internal headers. The CxfRsHeaderFilterStrategy, CxfHeaderFilterStrategy, and KnativeHttpHeaderFilterStrategy only filter outbound Camel‑internal headers via setOutFilterStartsWith, but do not configure inbound filtering via setInFilterStartsWith. As a result, an attacker can craft HTTP requests containing Camel‑internal headers such as CamelExecCommandExecutable or CamelFileName to CXF‑RS or CXF‑SOAP endpoints. These injected headers are then forwarded to components that interpret them, such as camel‑exec or camel‑file, allowing the attacker to override configured values and perform remote code execution or arbitrary file writes.

The vulnerability affects Apache Camel versions from 3.18.0 up to and including 4.14.5 and from 4.15.0 up to and including 4.18.1. The affected vendor is the Apache Software Foundation. Users running any of these releases are at risk until they apply a patch.

Exploitation requires only a crafted HTTP request to a CXF‑RS or CXF‑SOAP endpoint and no authentication. The CVSS score of 9.8 and EPSS score of < 1% indicate a high severity but low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, but the clear attack path and the potential for remote code execution warrant urgent remediation.